The one-iteration variant of PGD is known as the fast gradient method (FGM) when the normalized \(\operatorname{\mathbf {\ell }}_2\)  update is used and as the fast gradient sign method (FGSM) when the \(\operatorname{\mathbf {\ell }}_\infty \)  sign update is used [1]}.
Note that in both cases the step size is \(\alpha =\operatorname{\mathbf {\varepsilon }}\)  which leads to perturbations located on the boundary of the set \(\Delta \) .
These methods are fast but sometimes prone to catastrophic overfitting when the model overfits to FGM/FGSM but is not robust to iterative PGD attacks [2]}, [3]}.
This problem can be alleviated by specific regularization methods like CURE [4]}, [5]} or GradAlign [6]}.
However, for small enough \(\operatorname{\mathbf {\varepsilon }}\) , adversarial training with FGM/FGSM works as well as multi-step PGD [6]}.
